@blamejs/blamejs-shop 0.0.128 → 0.1.0

package/lib/vendor/blamejs/lib/mdoc.js

@@ -0,0 +1,305 @@
+"use strict";
+/**
+ * @module b.mdoc
+ * @nav    Crypto
+ * @title  ISO mdoc / mDL (ISO 18013-5)
+ *
+ * @intro
+ *   Verify the issuer-signed data of an ISO/IEC 18013-5 mdoc — the
+ *   credential format behind mobile driving licences (mDL) and the ISO
+ *   track of the EU Digital Identity Wallet. This is the relying-party
+ *   side: confirm that the data elements a holder presents were signed
+ *   by the issuer and have not been altered.
+ *
+ *   An mdoc's <code>IssuerSigned</code> structure carries the disclosed
+ *   data elements (<code>nameSpaces</code>) and an <code>issuerAuth</code>
+ *   that is a COSE_Sign1 (<code>b.cose</code>) over a Mobile Security
+ *   Object (MSO). The MSO holds, per namespace, a SHA-256/384/512 digest
+ *   of every issued element. <code>b.mdoc.verifyIssuerSigned</code>
+ *   verifies the COSE signature with the issuer certificate carried in
+ *   the COSE <code>x5chain</code> (label 33), parses the MSO, enforces
+ *   its <code>validityInfo</code> window, and — the integrity check that
+ *   makes selective disclosure trustworthy — recomputes the digest of
+ *   every disclosed element (the full Tag-24 <code>IssuerSignedItemBytes</code>)
+ *   and matches it against the MSO, constant-time. A disclosed element
+ *   whose digest is absent or mismatched is refused.
+ *
+ *   Signing algorithms follow <code>b.cose</code> verification: the
+ *   classical ES256 / 384 / 512 and EdDSA that real mDL issuers use are
+ *   accepted (consume-what-exists; the caller names the allowlist).
+ *   <code>opts.trustAnchorsPem</code> additionally verifies the issuer
+ *   certificate chain and its validity at the asserted time.
+ *
+ *   <strong>Scope.</strong> This is issuer-data authentication
+ *   (ISO 18013-5 §9.1.2.4) — the data is genuine and issuer-signed. The
+ *   mdoc <em>device authentication</em> half (DeviceSigned / the
+ *   SessionTranscript-bound holder-binding proof, §9.1.3) is deferred:
+ *   it needs the live session transcript a verifier negotiates, so it is
+ *   a presentation-protocol concern rather than a credential check.
+ *   Composes <code>b.cose</code> + <code>b.cbor</code>; no new runtime
+ *   dependency. Distinct from W3C VCDM (<code>b.vc</code>) and IETF
+ *   SD-JWT VC (<code>b.auth.sdJwtVc</code>) — the three credential
+ *   ecosystems.
+ *
+ * @card
+ *   ISO 18013-5 mdoc / mDL issuer-data verification — checks the
+ *   COSE_Sign1 IssuerAuth, the MSO validity window, and every disclosed
+ *   element's digest against the Mobile Security Object. Composes
+ *   b.cose + b.cbor; device-auth holder-binding deferred.
+ */
+
+var nodeCrypto = require("node:crypto");
+var C = require("./constants");
+var cbor = require("./cbor");
+var cose = require("./cose");
+var bCrypto = require("./crypto");
+var validateOpts = require("./validate-opts");
+var { defineClass } = require("./framework-error");
+
+var MdocError = defineClass("MdocError", { alwaysPermanent: true });
+
+var HDR_X5CHAIN = 33;                                  // allow:raw-byte-literal allow:raw-time-literal — x5chain COSE header label (RFC 9360 is a spec number, not a size/duration)
+var TAG_ENCODED_CBOR = 24;                             // allow:raw-byte-literal — RFC 8949 §3.4.5.1 embedded-CBOR tag
+// Tags ISO 18013-5 uses in issuer data: tdate(0), epoch(1), embedded
+// CBOR(24), full-date(1004, RFC 8943). Bounded — others are refused.
+var ALLOWED_TAGS = [0, 1, TAG_ENCODED_CBOR, 1004];
+var DIGEST_ALGS = { "SHA-256": "sha256", "SHA-384": "sha384", "SHA-512": "sha512" };
+
+function _bytes(x, what) {
+  if (Buffer.isBuffer(x)) return x;
+  if (x instanceof Uint8Array) return Buffer.from(x);
+  throw new MdocError("mdoc/bad-input", "mdoc: " + what + " must be a Buffer / Uint8Array of CBOR");
+}
+
+// validityInfo dates are tdate (Tag 0, an RFC 3339 string) or epoch
+// (Tag 1). Returns epoch-ms; fails closed on a malformed value.
+function _validityMs(v, name) {
+  var raw = (v instanceof cbor.Tag) ? v.value : v;
+  if (typeof raw === "string") {
+    var ms = Date.parse(raw);
+    if (!isFinite(ms)) throw new MdocError("mdoc/bad-validity", "mdoc: validityInfo." + name + " is not a valid date: " + raw);
+    return ms;
+  }
+  if (typeof raw === "number" && isFinite(raw)) return raw * C.TIME.seconds(1);    // epoch seconds → ms
+  throw new MdocError("mdoc/bad-validity", "mdoc: validityInfo." + name + " is missing or malformed");
+}
+
+function _mapGet(m, k) { return m instanceof Map ? m.get(k) : (m ? m[k] : undefined); }
+
+/**
+ * @primitive b.mdoc.verifyIssuerSigned
+ * @signature b.mdoc.verifyIssuerSigned(issuerSigned, opts)
+ * @since     0.12.40
+ * @status    experimental
+ * @compliance gdpr, soc2
+ * @related   b.cose.verify, b.vc.verify
+ *
+ * Verify the issuer-signed data of an ISO 18013-5 mdoc and return the
+ * disclosed elements. <code>issuerSigned</code> is the CBOR
+ * <code>IssuerSigned</code> map (the operator extracts it from the
+ * device response / QR). The COSE_Sign1 <code>issuerAuth</code> is
+ * verified with the issuer certificate from its <code>x5chain</code>
+ * header against the mandatory <code>opts.algorithms</code> allowlist;
+ * the MSO <code>validityInfo</code> window is enforced; and every
+ * disclosed element's digest is matched against the Mobile Security
+ * Object (a mismatch or absence is refused). Pass
+ * <code>opts.trustAnchorsPem</code> to also verify the issuer
+ * certificate chain.
+ *
+ * @opts
+ *   {
+ *     algorithms:      string[],  // required — accepted COSE alg names (ES256/384/512, EdDSA)
+ *     trustAnchorsPem: string|string[], // optional issuer roots — enables chain + validity verification
+ *     expectedDocType: string,    // require the MSO docType to match (e.g. "org.iso.18013.5.1.mDL")
+ *     at:              Date,      // validity instant (default now); must be a valid Date
+ *     maxBytes:        number,    // forwarded to b.cbor.decode
+ *     maxDepth:        number,
+ *   }
+ *
+ * @example
+ *   var out = await b.mdoc.verifyIssuerSigned(issuerSignedBytes, {
+ *     algorithms: ["ES256"], expectedDocType: "org.iso.18013.5.1.mDL",
+ *   });
+ *   // → { docType, validityInfo, namespaces: { "org.iso.18013.5.1": { family_name, age_over_18, … } }, signerCert, alg }
+ */
+async function verifyIssuerSigned(issuerSigned, opts) {
+  validateOpts.requireObject(opts, "mdoc.verifyIssuerSigned", MdocError);
+  validateOpts(opts, ["algorithms", "trustAnchorsPem", "expectedDocType", "at", "maxBytes", "maxDepth"], "mdoc.verifyIssuerSigned");
+  if (!Array.isArray(opts.algorithms) || opts.algorithms.length === 0) {
+    throw new MdocError("mdoc/algorithms-required", "mdoc.verifyIssuerSigned: opts.algorithms is required");
+  }
+  var at = new Date();
+  if (opts.at !== undefined && opts.at !== null) {
+    if (!(opts.at instanceof Date) || !isFinite(opts.at.getTime())) {
+      throw new MdocError("mdoc/bad-at", "mdoc.verifyIssuerSigned: opts.at must be a valid Date");
+    }
+    at = opts.at;
+  }
+  var decodeOpts = { allowedTags: ALLOWED_TAGS, maxBytes: opts.maxBytes, maxDepth: opts.maxDepth };
+
+  var top = cbor.decode(_bytes(issuerSigned, "issuerSigned"), decodeOpts);
+  var nameSpaces = _mapGet(top, "nameSpaces");
+  var issuerAuth = _mapGet(top, "issuerAuth");
+  if (!Array.isArray(issuerAuth) || issuerAuth.length !== 4) {
+    throw new MdocError("mdoc/malformed", "mdoc.verifyIssuerSigned: issuerAuth must be a COSE_Sign1 (4-element array)");
+  }
+
+  // The signer certificate rides in the COSE x5chain (label 33): a
+  // single cert bstr or an array of bstrs, leaf first.
+  var unprotected = issuerAuth[1];
+  var x5 = _mapGet(unprotected, HDR_X5CHAIN);
+  var chain = Array.isArray(x5) ? x5 : (x5 != null ? [x5] : []);
+  if (!chain.length || !Buffer.isBuffer(chain[0])) {
+    throw new MdocError("mdoc/no-cert", "mdoc.verifyIssuerSigned: issuerAuth has no x5chain certificate (label 33)");
+  }
+  // The x5chain certificate is attacker-controlled — a malformed DER
+  // must surface as a clean error, not a raw OpenSSL throw.
+  var signerCert;
+  try { signerCert = new nodeCrypto.X509Certificate(chain[0]); }
+  catch (e) {
+    throw new MdocError("mdoc/bad-cert", "mdoc.verifyIssuerSigned: x5chain certificate is not valid DER: " + ((e && e.message) || e));
+  }
+
+  // Verify the COSE_Sign1 signature with the embedded signer key.
+  var coseBytes = cbor.encode(issuerAuth);
+  var verified = await cose.verify(coseBytes, {
+    algorithms:  opts.algorithms,
+    keyResolver: function () { return signerCert.publicKey; },
+    maxBytes:    opts.maxBytes,
+    maxDepth:    opts.maxDepth,
+  });
+
+  // payload = Tag 24 ( bstr .cbor MSO ).
+  var payloadTag = cbor.decode(verified.payload, decodeOpts);
+  var msoBytes = (payloadTag instanceof cbor.Tag && payloadTag.tag === TAG_ENCODED_CBOR) ? payloadTag.value : null;
+  if (!Buffer.isBuffer(msoBytes)) {
+    throw new MdocError("mdoc/malformed", "mdoc.verifyIssuerSigned: issuerAuth payload is not a Tag-24 MobileSecurityObject");
+  }
+  var mso = cbor.decode(msoBytes, decodeOpts);
+
+  var digestAlgName = _mapGet(mso, "digestAlgorithm");
+  var digestNode = DIGEST_ALGS[digestAlgName];
+  if (!digestNode) {
+    throw new MdocError("mdoc/bad-digest-alg", "mdoc.verifyIssuerSigned: unsupported MSO digestAlgorithm '" + digestAlgName + "'");
+  }
+  var docType = _mapGet(mso, "docType");
+  if (opts.expectedDocType !== undefined && docType !== opts.expectedDocType) {
+    throw new MdocError("mdoc/doctype-mismatch", "mdoc.verifyIssuerSigned: MSO docType '" + docType + "' does not match expectedDocType");
+  }
+
+  // validityInfo window (fail closed on malformed dates).
+  var vi = _mapGet(mso, "validityInfo");
+  if (!(vi instanceof Map) && (!vi || typeof vi !== "object")) {
+    throw new MdocError("mdoc/malformed", "mdoc.verifyIssuerSigned: MSO has no validityInfo");
+  }
+  var nowMs = at.getTime();
+  var validFromMs = _validityMs(_mapGet(vi, "validFrom"), "validFrom");
+  var validUntilMs = _validityMs(_mapGet(vi, "validUntil"), "validUntil");
+  if (nowMs < validFromMs) throw new MdocError("mdoc/not-yet-valid", "mdoc.verifyIssuerSigned: credential not yet valid");
+  if (nowMs > validUntilMs) throw new MdocError("mdoc/expired", "mdoc.verifyIssuerSigned: credential validity has passed");
+
+  // Match every disclosed element's digest against the MSO. The digest
+  // covers the full Tag-24 IssuerSignedItemBytes (ISO 18013-5 §9.1.2.5).
+  var valueDigests = _mapGet(mso, "valueDigests");
+  var out = {};
+  if (nameSpaces instanceof Map) {
+    var nsNames = Array.from(nameSpaces.keys());
+    for (var ni = 0; ni < nsNames.length; ni += 1) {
+      var ns = nsNames[ni];
+      var items = nameSpaces.get(ns);
+      var nsDigests = _mapGet(valueDigests, ns);
+      if (!Array.isArray(items) || !(nsDigests instanceof Map)) {
+        throw new MdocError("mdoc/malformed", "mdoc.verifyIssuerSigned: namespace '" + ns + "' has no matching valueDigests");
+      }
+      out[ns] = {};
+      var seen = Object.create(null);                 // dup-elementIdentifier guard (proto-safe)
+      for (var ii = 0; ii < items.length; ii += 1) {
+        var item = items[ii];
+        if (!(item instanceof cbor.Tag) || item.tag !== TAG_ENCODED_CBOR || !Buffer.isBuffer(item.value)) {
+          throw new MdocError("mdoc/malformed", "mdoc.verifyIssuerSigned: IssuerSignedItem is not a Tag-24 byte string");
+        }
+        var itemBytes = cbor.encode(new cbor.Tag(TAG_ENCODED_CBOR, item.value));
+        var digest = nodeCrypto.createHash(digestNode).update(itemBytes).digest();
+        var inner = cbor.decode(item.value, decodeOpts);
+        var digestID = _mapGet(inner, "digestID");
+        var expected = nsDigests.get(digestID);
+        if (!Buffer.isBuffer(expected) || !bCrypto.timingSafeEqual(digest, expected)) {
+          throw new MdocError("mdoc/digest-mismatch",
+            "mdoc.verifyIssuerSigned: disclosed element (digestID " + digestID + ", namespace " + ns + ") does not match the MSO");
+        }
+        // Refuse a duplicate elementIdentifier within a namespace — two
+        // signed values for one element is ambiguous; fail closed rather
+        // than silently keep the last.
+        var elementId = _mapGet(inner, "elementIdentifier");
+        if (seen[elementId]) {
+          throw new MdocError("mdoc/duplicate-element",
+            "mdoc.verifyIssuerSigned: namespace '" + ns + "' has duplicate elementIdentifier '" + elementId + "'");
+        }
+        seen[elementId] = true;
+        out[ns][elementId] = _mapGet(inner, "elementValue");
+      }
+    }
+  }
+
+  // Optional issuer chain + validity at the asserted time.
+  if (opts.trustAnchorsPem !== undefined && opts.trustAnchorsPem !== null) {
+    var anchors = typeof opts.trustAnchorsPem === "string" ? [opts.trustAnchorsPem] : opts.trustAnchorsPem;
+    if (!Array.isArray(anchors) || anchors.length === 0 ||
+        !anchors.every(function (a) { return typeof a === "string" && a.length > 0; })) {
+      throw new MdocError("mdoc/bad-trust-anchors", "mdoc.verifyIssuerSigned: trustAnchorsPem must be a non-empty PEM string or array");
+    }
+    _verifyChain(chain, anchors, at);
+  }
+
+  return {
+    docType:      docType,
+    version:      _mapGet(mso, "version"),
+    digestAlgorithm: digestAlgName,
+    validityInfo: { validFrom: new Date(validFromMs), validUntil: new Date(validUntilMs) },
+    namespaces:   out,
+    signerCert:   signerCert.toString(),
+    alg:          verified.alg,
+  };
+}
+
+// Verify the leaf (chain[0]) chains to a supplied anchor and every cert
+// is valid at `at`. Intermediates in the x5chain are consulted.
+function _verifyChain(chainDer, anchorsPem, at) {
+  var anchors = anchorsPem.map(function (p) { return new nodeCrypto.X509Certificate(p); });
+  var pool = chainDer.map(function (d) { return new nodeCrypto.X509Certificate(d); });
+  var current = pool[0];
+  var atMs = at.getTime();
+  var steps = 0;
+  while (steps <= pool.length + 1) {
+    _assertValidAt(current, atMs);
+    for (var a = 0; a < anchors.length; a += 1) {
+      if (_issued(anchors[a], current)) { _assertValidAt(anchors[a], atMs); return; }
+      if (current.fingerprint256 === anchors[a].fingerprint256) return;
+    }
+    var parent = null;
+    for (var p = 0; p < pool.length; p += 1) {
+      if (pool[p].fingerprint256 !== current.fingerprint256 && _issued(pool[p], current)) { parent = pool[p]; break; }
+    }
+    if (!parent) {
+      throw new MdocError("mdoc/untrusted-chain", "mdoc.verifyIssuerSigned: issuer certificate does not chain to a supplied trust anchor");
+    }
+    current = parent;
+    steps += 1;
+  }
+  throw new MdocError("mdoc/chain-loop", "mdoc.verifyIssuerSigned: certificate chain did not terminate");
+}
+function _issued(issuer, subject) {
+  try { return subject.checkIssued(issuer) && subject.verify(issuer.publicKey); }
+  catch (_e) { return false; }
+}
+function _assertValidAt(cert, atMs) {
+  if (atMs < cert.validFromDate.getTime() || atMs > cert.validToDate.getTime()) {
+    throw new MdocError("mdoc/cert-expired", "mdoc.verifyIssuerSigned: certificate '" + cert.subject + "' is not valid at the asserted time");
+  }
+}
+
+module.exports = {
+  verifyIssuerSigned: verifyIssuerSigned,
+  DIGEST_ALGS:        DIGEST_ALGS,
+  MdocError:          MdocError,
+};

package/lib/vendor/blamejs/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.12.39",
+  "version": "0.12.41",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/lib/vendor/blamejs/release-notes/v0.12.40.json

@@ -0,0 +1,18 @@
+{
+  "$schema": "../scripts/release-notes-schema.json",
+  "version": "0.12.40",
+  "date": "2026-05-24",
+  "headline": "`b.mdoc` — ISO 18013-5 mdoc / mDL issuer-data verification",
+  "summary": "Verify the issuer-signed data of an ISO/IEC 18013-5 mdoc — the credential format behind mobile driving licences (mDL) and the ISO track of the EU Digital Identity Wallet. This is the relying-party side: confirm that the data elements a holder presents were signed by the issuer and have not been altered. An mdoc's IssuerSigned carries the disclosed data elements and an issuerAuth that is a COSE_Sign1 (b.cose) over a Mobile Security Object (MSO) holding a per-element digest. b.mdoc.verifyIssuerSigned verifies the COSE signature with the issuer certificate from the COSE x5chain header, parses the MSO, enforces its validityInfo window, and recomputes each disclosed element's digest (the full Tag-24 IssuerSignedItemBytes) to match it against the MSO constant-time — the integrity check that makes selective disclosure trustworthy. An absent or mismatched digest is refused. Signing algorithms follow b.cose verification (the classical ES256/384/512 + EdDSA that real mDL issuers use; the caller names the allowlist); opts.trustAnchorsPem additionally verifies the issuer certificate chain. This completes the credential trio alongside W3C VCDM (b.vc) and IETF SD-JWT VC (b.auth.sdJwtVc). Composes b.cose + b.cbor; no new runtime dependency.",
+  "sections": [
+    {
+      "heading": "Added",
+      "items": [
+        {
+          "title": "`b.mdoc.verifyIssuerSigned(issuerSigned, opts)`",
+          "body": "Takes the CBOR `IssuerSigned` map (the operator extracts it from the device response / QR) and returns `{ docType, version, digestAlgorithm, validityInfo, namespaces, signerCert, alg }`. Verifies the COSE_Sign1 `issuerAuth` against the mandatory `opts.algorithms` allowlist using the issuer certificate from its `x5chain` (label 33) header; parses the Tag-24 Mobile Security Object; enforces the MSO `validityInfo` window against `opts.at` (default now; must be a valid Date; malformed dates fail closed); and recomputes the digest of every disclosed `IssuerSignedItem` (over the full Tag-24 bytes, with the MSO `digestAlgorithm` — SHA-256/384/512) to match the MSO `valueDigests` constant-time — an absent or mismatched digest is refused with `mdoc/digest-mismatch`. `opts.expectedDocType` pins the document type; `opts.trustAnchorsPem` (a PEM string or array) additionally verifies the issuer certificate chain and validity at the asserted time. A malformed `x5chain` certificate is refused with a clean `mdoc/bad-cert`. The mdoc device-authentication half (the SessionTranscript-bound holder-binding proof) is a presentation-protocol concern and is not part of issuer-data verification."
+        }
+      ]
+    }
+  ]
+}

package/lib/vendor/blamejs/release-notes/v0.12.41.json

@@ -0,0 +1,18 @@
+{
+  "$schema": "../scripts/release-notes-schema.json",
+  "version": "0.12.41",
+  "date": "2026-05-24",
+  "headline": "`b.did` — W3C DID resolution (did:key + did:web) feeding the credential verifiers",
+  "summary": "Resolve W3C Decentralized Identifiers (DID Core 1.0) to verification keys — the link that lets a credential's issuer be named by a DID rather than a raw key. Resolve the issuer DID of a b.vc / b.mdoc / b.scitt credential to a node:crypto KeyObject and hand it to the verifier. did:key encodes the public key in the identifier (multicodec + base58btc), so resolution is deterministic and offline — Ed25519, P-256, P-384, and secp256k1 round-trip; did:web places the DID document at an HTTPS URL derived from the identifier, with the network fetch left to the operator (the framework parses the operator-fetched document and extracts its verification methods, as publicKeyMultibase or publicKeyJwk). b.did.keyToDid encodes a KeyObject as a did:key (an issuer naming itself), b.did.parse splits the identifier (and returns the did:web URL to fetch), and b.did.resolve returns the document and verification keys. DID Core 1.0 is a W3C Recommendation; the method specs (did:key W3C CCG report, did:web DID method registry — EUDI-mandated) are deployed-stable. Composes node:crypto; no new runtime dependency.",
+  "sections": [
+    {
+      "heading": "Added",
+      "items": [
+        {
+          "title": "`b.did.resolve(did, opts?)` / `b.did.keyToDid(publicKey)` / `b.did.parse(did)`",
+          "body": "`resolve` returns `{ didDocument, verificationMethods: [{ id, controller, type, publicKey }] }` with each `publicKey` a `node:crypto` KeyObject ready for `b.vc.verify` / `b.mdoc.verifyIssuerSigned` / `b.scitt.verifyStatement`. did:key resolves deterministically and offline (base58btc + multicodec → Ed25519 raw key or EC compressed point, rebuilt via SPKI); did:web requires the operator to pass the fetched DID document as `opts.document` (the URL to GET is on `b.did.parse(did).url`) and the document `id` must match the requested DID. A publicKeyJwk in a DID document is imported only after its `kty`/`crv` is allowlisted (Ed25519 / P-256 / P-384 / secp256k1) — an unexpected key type from an untrusted document is refused, not blindly imported. `keyToDid` encodes an Ed25519 / P-256 / P-384 / secp256k1 KeyObject as a did:key; `parse` derives the did:web HTTPS URL (`host[:port][:path]` → `https://host/path/did.json`, or `/.well-known/did.json`). Unknown methods, malformed base58, unsupported multicodec codes, and unsupported key types are each refused."
+        }
+      ]
+    }
+  ]
+}

package/lib/vendor/blamejs/test/layer-0-primitives/codebase-patterns.test.js

@@ -2252,6 +2252,24 @@ async function testNoDuplicateCodeBlocks() {
       ],
       reason: "v0.12.33 — opts / structure validation prelude (`validateOpts(allowedKeys) + chained required-field + typeof guards + typed-error throw`). cose.verify validates a COSE_Sign1 opts blob + decoded structure (RFC 9052); the peers each validate a distinct spec's shape (SD-JWT-VC issuer opts / break-glass policy set / JSCalendar object / DDL dual-control declaration / DSR request / FedCM well-known manifest / Android Asset Links / heartbeat config). Each throws a primitive-specific typed error; the shingle is the validateOpts-then-guard idiom, not behaviour. Same family as the v0.12.29 input-shape-validation cluster.",
     },
+    {
+      mode:  "family-subset",
+      files: [
+        "lib/mdoc.js:verifyIssuerSigned",
+        "lib/tsa.js:verifyToken",
+        "lib/vc.js:verify",
+      ],
+      reason: "v0.12.40 — signature-verify entry preamble shared by three credential / token verifiers: `validateOpts(allowedKeys) + mandatory algorithms-allowlist check + opts.at valid-Date guard + publicKey/keyResolver presence check`, then divergent domain logic. tsa.verifyToken verifies an RFC 3161 timestamp token (CMS SignedData + message-imprint + EKU); vc.verify verifies a W3C VC-JOSE-COSE credential (JWS/COSE + VCDM structural + validity window); mdoc.verifyIssuerSigned verifies an ISO 18013-5 mdoc (COSE_Sign1 IssuerAuth + MSO valueDigests matching). Each consumes a different wire format, returns a different shape, and throws a primitive-specific typed error — the shingle is the validate-then-guard preamble, not behaviour. Same family as the v0.12.33 cose.verify cluster.",
+    },
+    {
+      mode:  "family-subset",
+      files: [
+        "lib/dual-control.js:create",
+        "lib/mdoc.js:verifyIssuerSigned",
+        "lib/tsa.js:verifyToken",
+      ],
+      reason: "v0.12.40 — validateOpts-then-guard prelude shared between a create-style validator (dual-control.create builds a two-person-rule grant after validating its opts) and the timestamp / mdoc verifiers. The common shingle is the `validateOpts(allowedKeys) + chained guard + typed-error` idiom; the bodies diverge entirely (dual-control persists a control record; tsa/mdoc verify cryptographic structures). Same validate-then-guard family as the v0.12.29 / v0.12.33 clusters.",
+    },
     {
       mode:  "family-subset",
       files: [
@@ -6197,8 +6215,16 @@ var KNOWN_ANTIPATTERNS = [
       // jwtExternal._assertAlgKtyMatch BEFORE createPublicKey on
       // the browser-supplied DBSC binding JWK.
       "lib/dbsc.js",
+      // did.js — _jwkToKey allowlists the JWK's kty/crv (OKP/Ed25519 or
+      // EC/P-256/P-384/secp256k1) and refuses any other type BEFORE
+      // createPublicKey, which is the DID-context equivalent of the
+      // alg/kty cross-check: a DID document carries verification keys,
+      // not a verification alg (the consuming verifier — b.vc / b.mdoc —
+      // supplies the alg allowlist), so there is no `alg` to pass to
+      // _assertAlgKtyMatch; the kty/crv allowlist is the confusion guard.
+      "lib/did.js",
     ],
-    reason: "CVE-2026-22817 — every JWT verifier that resolves a JWK BY ATTACKER-CONTROLLED HEADER (kid / x5t) must cross-check the declared alg against the JWK's kty (and crv for EC) BEFORE handing the key to node:crypto.verify. Imports that skip the check are exactly the confused-deputy shape (RS256→HS256 family). The shared helper `jwtExternal._assertAlgKtyMatch(alg, jwk)` is the single point of enforcement; new code routes through it. Allowlist entries are sign-side / pinned-cert paths where the JWK is not attacker-supplied.",
+    reason: "CVE-2026-22817 — every JWT verifier that resolves a JWK BY ATTACKER-CONTROLLED HEADER (kid / x5t) must cross-check the declared alg against the JWK's kty (and crv for EC) BEFORE handing the key to node:crypto.verify. Imports that skip the check are exactly the confused-deputy shape (RS256→HS256 family). The shared helper `jwtExternal._assertAlgKtyMatch(alg, jwk)` is the single point of enforcement; new code routes through it. Allowlist entries are sign-side / pinned-cert paths where the JWK is not attacker-supplied, or (did.js) where a kty/crv allowlist stands in for alg/kty because the format carries no verification alg.",
   },
   {
     // CVE-2026-23552 — cross-realm JWT acceptance via non-CT iss

package/lib/vendor/blamejs/test/layer-0-primitives/did.test.js

@@ -0,0 +1,147 @@
+"use strict";
+/**
+ * Layer 0 — b.did (W3C DID resolution: did:key + did:web).
+ * Covers the published did:key spec vector (an independent-implementation
+ * oracle), Ed25519 / P-256 / P-384 / secp256k1 keyToDid ↔ resolve
+ * round-trips, did:web URL derivation + document extraction
+ * (publicKeyMultibase + publicKeyJwk), the integration with b.vc
+ * (resolve an issuer DID → verify its credential), and the refusal paths.
+ */
+
+var b = require("../../index");
+var helpers = require("../helpers");
+var check = helpers.check;
+var nodeCrypto = require("node:crypto");
+
+// Published did:key Ed25519 example (W3C CCG did:key test vector).
+var SPEC_ED25519 = "did:key:z6MkpTHR8VNsBxYAAWHut2Geadd9jSwuBV8xRoAnwWsdvktH";
+
+function testSurface() {
+  check("b.did.parse is a function", typeof b.did.parse === "function");
+  check("b.did.resolve is a function", typeof b.did.resolve === "function");
+  check("b.did.keyToDid is a function", typeof b.did.keyToDid === "function");
+  check("b.did.MULTICODEC maps Ed25519", b.did.MULTICODEC[0xed].name === "Ed25519");
+  check("b.did.DidError is a class", typeof b.did.DidError === "function");
+}
+
+function testSpecVector() {
+  var r = b.did.resolve(SPEC_ED25519);
+  check("spec vector: resolves to an Ed25519 key", r.verificationMethods[0].publicKey.asymmetricKeyType === "ed25519");
+  check("spec vector: verificationMethod type Ed25519", r.verificationMethods[0].type === "Ed25519");
+  check("spec vector: DID document has assertionMethod + authentication", r.didDocument.assertionMethod.length === 1 && r.didDocument.authentication.length === 1);
+  // Re-encoding the resolved key must reproduce the exact published DID —
+  // an independent-implementation interop check.
+  check("spec vector: keyToDid round-trips the published DID", b.did.keyToDid(r.verificationMethods[0].publicKey) === SPEC_ED25519);
+}
+
+// Key equality via JWK (an EC point imported from a compressed form may
+// re-export with a different point_conversion_form, so SPKI bytes can
+// differ even for the same key — compare the coordinates instead).
+function _spkiEq(a, b2) {
+  var ja = a.export({ format: "jwk" }), jb = b2.export({ format: "jwk" });
+  return ja.kty === jb.kty && ja.crv === jb.crv && ja.x === jb.x && (ja.y || "") === (jb.y || "");
+}
+
+function testRoundTrips() {
+  // Ed25519
+  var ed = nodeCrypto.generateKeyPairSync("ed25519");
+  var edDid = b.did.keyToDid(ed.publicKey);
+  check("Ed25519: did:key starts z6Mk", edDid.indexOf("did:key:z6Mk") === 0);
+  check("Ed25519: resolve round-trips the key", _spkiEq(b.did.resolve(edDid).verificationMethods[0].publicKey, ed.publicKey));
+
+  // P-256 (the EUDI / mdoc curve) — did:key starts zDna
+  var p = nodeCrypto.generateKeyPairSync("ec", { namedCurve: "P-256" });
+  var pDid = b.did.keyToDid(p.publicKey);
+  check("P-256: did:key starts zDn", pDid.indexOf("did:key:zDn") === 0);
+  check("P-256: resolve round-trips the key", _spkiEq(b.did.resolve(pDid).verificationMethods[0].publicKey, p.publicKey));
+
+  // P-384
+  var p384 = nodeCrypto.generateKeyPairSync("ec", { namedCurve: "secp384r1" });
+  check("P-384: resolve round-trips the key", _spkiEq(b.did.resolve(b.did.keyToDid(p384.publicKey)).verificationMethods[0].publicKey, p384.publicKey));
+
+  // secp256k1
+  var k1 = nodeCrypto.generateKeyPairSync("ec", { namedCurve: "secp256k1" });
+  check("secp256k1: resolve round-trips the key", _spkiEq(b.did.resolve(b.did.keyToDid(k1.publicKey)).verificationMethods[0].publicKey, k1.publicKey));
+}
+
+async function testCredentialIntegration() {
+  // The point of b.did: resolve an issuer DID, then verify its credential.
+  var issuer = nodeCrypto.generateKeyPairSync("ec", { namedCurve: "P-256" });
+  var issuerDid = b.did.keyToDid(issuer.publicKey);
+  var cred = {
+    "@context": ["https://www.w3.org/ns/credentials/v2"],
+    type: ["VerifiableCredential"], issuer: issuerDid,
+    credentialSubject: { id: "did:example:subject" },
+  };
+  var jws = await b.vc.issue(cred, { securing: "jose", alg: "ES256", privateKey: issuer.privateKey });
+  var resolvedKey = b.did.resolve(issuerDid).verificationMethods[0].publicKey;
+  var out = await b.vc.verify(jws, { algorithms: ["ES256"], publicKey: resolvedKey, expectedIssuer: issuerDid });
+  check("integration: resolved issuer DID verifies its b.vc credential", out.issuer === issuerDid);
+}
+
+function testDidWeb() {
+  var p = b.did.parse("did:web:example.com:issuers:42");
+  check("did:web: method + id parsed", p.method === "web" && p.id === "example.com:issuers:42");
+  check("did:web: path URL derived", p.url === "https://example.com/issuers/42/did.json");
+  check("did:web: bare host → .well-known", b.did.parse("did:web:example.com").url === "https://example.com/.well-known/did.json");
+  // Port encoded as %3A in the host is decoded to ':'.
+  check("did:web: %3A port decoded in host", b.did.parse("did:web:example.com%3A8443:a").url === "https://example.com:8443/a/did.json");
+  // Escaped reserved chars in a PATH segment stay verbatim (not turned
+  // into URL control syntax) — a path %3F must not become '?'.
+  check("did:web: escaped delimiter in path preserved", b.did.parse("did:web:example.com:foo%3Fbar").url === "https://example.com/foo%3Fbar/did.json");
+  // A malformed percent-escape must not throw a raw URIError.
+  var pctCode = (function () { try { b.did.parse("did:web:example.com:%"); return "ok"; } catch (e) { return e.code || e.name; } })();
+  check("did:web: malformed escape does not throw URIError", pctCode === "ok");
+
+  var issuer = nodeCrypto.generateKeyPairSync("ec", { namedCurve: "P-256" });
+  var webDid = "did:web:example.com";
+  // publicKeyJwk verification method
+  var docJwk = {
+    "@context": ["https://www.w3.org/ns/did/v1"], id: webDid,
+    verificationMethod: [{ id: webDid + "#k1", controller: webDid, type: "JsonWebKey2020", publicKeyJwk: issuer.publicKey.export({ format: "jwk" }) }],
+  };
+  var rJwk = b.did.resolve(webDid, { document: docJwk });
+  check("did:web: publicKeyJwk → KeyObject", _spkiEq(rJwk.verificationMethods[0].publicKey, issuer.publicKey));
+
+  // publicKeyMultibase verification method (did:key-style)
+  var ed = nodeCrypto.generateKeyPairSync("ed25519");
+  var multibase = b.did.keyToDid(ed.publicKey).slice("did:key:".length);
+  var docMb = {
+    "@context": ["https://www.w3.org/ns/did/v1"], id: webDid,
+    verificationMethod: [{ id: webDid + "#k1", controller: webDid, type: "Multikey", publicKeyMultibase: multibase }],
+  };
+  check("did:web: publicKeyMultibase → KeyObject", _spkiEq(b.did.resolve(webDid, { document: docMb }).verificationMethods[0].publicKey, ed.publicKey));
+}
+
+function testRefusals() {
+  function code(fn) { try { fn(); return "NO-THROW"; } catch (e) { return e.code; } }
+  check("not a DID refused", code(function () { b.did.parse("https://x"); }) === "did/bad-did");
+  check("unsupported method refused", code(function () { b.did.resolve("did:ion:abc"); }) === "did/unsupported-method");
+  check("did:web without document refused", code(function () { b.did.resolve("did:web:example.com"); }) === "did/document-required");
+  check("did:key non-multibase refused", code(function () { b.did.resolve("did:key:Qabc"); }) === "did/bad-did");
+  check("did:key bad base58 refused", code(function () { b.did.resolve("did:key:z0OIl"); }) === "did/bad-base58");
+  check("did:web document id mismatch refused", code(function () {
+    b.did.resolve("did:web:example.com", { document: { id: "did:web:evil.com", verificationMethod: [] } });
+  }) === "did/document-mismatch");
+  // RSA key cannot be a did:key
+  var rsa = nodeCrypto.generateKeyPairSync("rsa", { modulusLength: 2048 });
+  check("RSA key → unsupported", code(function () { b.did.keyToDid(rsa.publicKey); }) === "did/unsupported-key");
+}
+
+async function run() {
+  testSurface();
+  testSpecVector();
+  testRoundTrips();
+  await testCredentialIntegration();
+  testDidWeb();
+  testRefusals();
+}
+
+module.exports = { run: run };
+
+if (require.main === module) {
+  run().then(
+    function () { console.log("[did] OK — " + helpers.getChecks() + " checks passed"); },
+    function (e) { console.error("FAIL:", e && e.stack || e); process.exit(1); }
+  );
+}